To which (STRIDE/CIA+AAA) security category do command injection attacks belong?

Or is my question too simplistic? Does it depend on the specifics of the injection attack (trying to get at confidential information, trying to cause a denial of service), or should it be thought of as tampering (compromise integrity of user input) or elevation of privilege (having some program (the web server) perform an action with their privileges on your behalf)?

  • 1
    I've always taken the approach as long as you've identified the threat in your modelling which category you place it in STRIDE doesn't matter too much. You could always put it in multiple ones if needed, depends on your corporate policy on how you implement STRIDE
    Oct 20, 2017 at 12:24
  • 1
    that said... Spoofing or Tampering seems a good choice.
    Oct 20, 2017 at 12:25
  • @ISMSDEV, I'm just wondering: if none of the categories seems a natural fit, then how will they help identify other threats which also do not categorize nicely...
    – hkBst
    Oct 20, 2017 at 12:52

1 Answer 1


Command injection attacks don't fit nicely in the STRIDE framework or in the CIA/AAA paradigm, and there's a reason for that.

The CIA/AAA paradigm provides a set of goals of information security, and it's not meant to characterize attacks.

As for the STRIDE model, it provides a classification of threats for threat modeling purposes. However, that is just the beginning of threat modeling.

In fact, threat modeling often uses threat graphs, or other representations, to identify all the possible threats to a system starting from the broad STRIDE category.

Example. For the Information disclosure category, what kind of information can an attacker disclose? For each kind of information, what different cases should be distinguished? For each such case, what kind of attacks could be successful?

In this way, threat modeling is not tied to specific vulnerabilities and also allows to understand how many threats could a given patch fix. It's very useful.

So, the STRIDE model is just the beginning of threat modeling, which explains why specific attacks (like command injection) don't fit nicely into it. But, in the particular case of command injection attacks, there is another reason.

The point of command injection is that an attacker can send commands to a system. Therefore, a command injection attack could be used to do anything, from erasing logs (Tampering), to carry out a DDoS (Denial of service), to privilege escalation, to information disclosure (see SQLi,...), and much more. Basically, the whole STRIDE model, and the whole CIA/AAA paradigm.

One may argue that command injection is the most general attack ever, since it simply means that the attacker has the capability to send commands to a system. The purpose of these commands is the real threat.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .